Hosting and Streaming Your Own Videos Securely Using Amazon's Simple Storage Service (S3)

The Web Page

Here's the walk-through; you can open the code in another window to compare them side-by-side.

Lines 1-16 are pretty standard web stuff. If you're not using that type of header in your web pages, figure out why. The rest is discussed below, line by line:

17 Begins the PHP code
18 Tells the code what your public shareable not-secret Amazon S3 key is
19 Tells the code what your private, never ever let anyone see this Amazon S3 secret key is. Do not type this; copy and paste from Amazon's tool.
20 Your link needs to expire at some point so folks can't just share the page forever. This sets the timeout to one hour from now, sixty seconds times sixty. Adjust as needed.
21 When you created your Amazon account, you created a unique bucket name. Put it here.
22 This is the name of the video file. Please don't use spaces. Spaces are evil on the web.
23 Don't touch this line. It tells the encryption tool important information.
24 This is where the magic happens; your password info is encrypted along with the timeout, so the resulting link is secure. I'll share the tiny bit I know about each step. It actually happens inside out, so we start in the middle and work towards both ends.
24a The magic text string we created in line 23, which is Amazon's required format.
24b To process the string, we first encode it as UTF-8. It's about using characters that won't break later in the process. Look it up.
24c The first parameter of the encryption function. Read painful amounts of info about cryptographic hash functions if you really must.
24d The next parameter of the encryption function, your super-secret Amazon S3 key.
24e Tells the encryption function to output raw binary data instead of, well, something else. I'm gonna have to ask you not to mess with the case, because, especially if you're a Windows user, you'll be amazed to discover that some things on the web are case sensitive. Really. Oh; fine, there's more if you want it.
24f The encryption function is called.
24g The closing paren of the encryption function.
24h And now we do character-encoding using base 64. I do not know why. I barely know what base 64 character-encoding is.
24i The closing paren of the base64 encoding function.
24j And finally, we use PHP's urlencode function to make sure all the characters in our string are web-ready. Don't use htmlentities.
24k The closing paren of the urlencode function, and
24l the magic closing semicolon without which PHP is reduced to a blank white page, driving me mad.
25 The next three lines string together the command S3 needs to see to allow access to the file.
26
27
28 This compiles the bits into a single link.
29 Thus endeth the PHP code.
30
31 This opens the Flowplayer code.
32
33 Back to PHP for a moment.
34 Tell Flowplayer where the file lives by passing it the encrypted secure link we've created. Here's where it got dodgy. Okay, it got downright ugly. Flowplayer chokes on the plus sign (+) when it really shouldn't. The plus sign is a perfectly viable symbol even in a web link, except somewhere along the line it became tradition for it to symbolize a blank space (please see 'Spaces Are Evil' above.) The original code I found used PHP's 'htmlentities' function to make the link web-ready, and it refused to work. Someone on the Flowplayer forum suggested PHP's 'urlencode' function instead, and it was a huge bingo.
35 End the PHP.
36 More Flowplayer code starts.
37 This is the unique ID of the link we created in line 34, and the location of the Flowplayer itself. Since we put it in the same folder as this web page, it's simply the name of the player's SWF file.
38 Opening the Javascript function.
39 Telling Flowplayer what to do with the video clip.
40
41 I hate audio or video that start yelling at me on a web page so I've set 'autostart' to 'false.' You are free to follow my fine example of courteous behaviour.
42 Streaming without buffering is goofy unless your visitors have optical fiber right to their computer.
43 Closing up the Flowplayer parameters
44 and the Flowplayer code
45 and the script that called it.
Lines 46-48 end the web page.